I. Shell_TrayWnd inject was publically available since 2009 and was initially posted on virustech.org - PUBLIC forum as PUBLIC post.
II. SetWindowLongA it call sets address of injected shellcode not KiUserApcDispatcher (wtf Matrosov?) as proflink use 82a19f2e4c9a1b4295a51df9d23af84aae848a7984c141a0c7f67b3bbb77b271 attached sample. Break on SetWindowLongA - address it points located in explorer.exe address space - dump it and look inside.

The method of code injection used by Gapz is not isolated by Sandboxie 3.76 and Sandboxie 4.01 (Windows XP only), x86. As sandboxing 4.0x now uses limited accounts for sandboxed processes it is indeed more difficult to exploit - arbitrary code execution also will not work from restricted account, as GetWindowLongPtr/SetWindowLongPtr will fail. It is very boring to test but if you want you can follow steps described in that link from exelab.

If Sandboxie allows this, then this kind of sandboxing is one big lulz and successful explotation of this code is a question of just another exploit suitable for arbitrary code execution. Need more testing in various systems, various sections. As this is paid software I have no intentions to help author fix his ridiculous bugs or mistakes in sandbox architecture overall.

This method of arbitrary code execution was known for years before Matrosov "discovery" and we pretty sure know how and where he found it, hmm.. "itw".

If you really care about security you already use virtual machine (freeware btw), not paid half-part implemented virtualization with sleeping zerodays.